public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-10-31 16:54:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

kprobes: Fix possible use-after-free issue on kprobe registration

Browse source 
When unloading a module, its state is changing MODULE_STATE_LIVE ->
 MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take
a time. `is_module_text_address()` and `__module_text_address()`
works with MODULE_STATE_LIVE and MODULE_STATE_GOING.
If we use `is_module_text_address()` and `__module_text_address()`
separately, there is a chance that the first one is succeeded but the
next one is failed because module->state becomes MODULE_STATE_UNFORMED
between those operations.

In `check_kprobe_address_safe()`, if the second `__module_text_address()`
is failed, that is ignored because it expected a kernel_text address.
But it may have failed simply because module->state has been changed
to MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify
non-exist module text address (use-after-free).

To fix this problem, we should not use separated `is_module_text_address()`
and `__module_text_address()`, but use only `__module_text_address()`
once and do `try_module_get(module)` which is only available with
MODULE_STATE_LIVE.

Link: https://lore.kernel.org/all/20240410015802.265220-1-zhengyejian1@huawei.com/

Fixes: 28f6c37a29 ("kprobes: Forbid probing on trampoline and BPF code areas")
Cc: stable@vger.kernel.org
Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
This commit is contained in:
Zheng Yejian 2024-04-10 09:58:02 +08:00 • committed by Masami Hiramatsu (Google)
parent fec50db703
commit 325f3fb551
1 changed files with 12 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
kernel/kprobes.c
View file

@ -1567,10 +1567,17 @@ static int check_kprobe_address_safe(struct kprobe *p,
jump_label_lock(); jump_label_lock();
preempt_disable(); preempt_disable();
/* Ensure it is not in reserved area nor out of text */ /* Ensure the address is in a text area, and find a module if exists. */
if (!(core_kernel_text((unsigned long) p->addr) || *probed_mod = NULL;
is_module_text_address((unsigned long) p->addr)) || if (!core_kernel_text((unsigned long) p->addr)) {
in_gate_area_no_mm((unsigned long) p->addr) || *probed_mod = __module_text_address((unsigned long) p->addr);
if (!(*probed_mod)) {
ret = -EINVAL;
goto out;
}
}
/* Ensure it is not in reserved area. */
if (in_gate_area_no_mm((unsigned long) p->addr) ||
within_kprobe_blacklist((unsigned long) p->addr) || within_kprobe_blacklist((unsigned long) p->addr) ||
jump_label_text_reserved(p->addr, p->addr) || jump_label_text_reserved(p->addr, p->addr) ||
static_call_text_reserved(p->addr, p->addr) || static_call_text_reserved(p->addr, p->addr) ||
@ -1580,8 +1587,7 @@ static int check_kprobe_address_safe(struct kprobe *p,
goto out; goto out;
} }
/* Check if 'p' is probing a module. */ /* Get module refcount and reject __init functions for loaded modules. */
*probed_mod = __module_text_address((unsigned long) p->addr);
if (*probed_mod) { if (*probed_mod) {
/* /*
* We must hold a refcount of the probed module while updating * We must hold a refcount of the probed module while updating